test_preserve_shared_assets_security.py
python
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
10 hours ago
| 1 | """Security — preserve-shared-assets does not leak contents (§PSA.8).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | import io |
| 6 | import json |
| 7 | from contextlib import redirect_stderr, redirect_stdout |
| 8 | from pathlib import Path |
| 9 | |
| 10 | from cli.context import CliContext |
| 11 | from cli.kit_root import kit_root |
| 12 | from cli.main import main |
| 13 | from cli.output import OutputContext |
| 14 | from tests.support import PILOT, muse_mirror_status_runner, seed_pilot_tree |
| 15 | |
| 16 | SECRET_MARKER = "SUPERSECRET_BRIDGE_TOKEN_xyz" |
| 17 | |
| 18 | |
| 19 | def test_preserve_report_json_omits_file_contents(tmp_path: Path) -> None: |
| 20 | seed_pilot_tree( |
| 21 | tmp_path, |
| 22 | handover_rel="docs/OVERSEER-HANDOVER.md", |
| 23 | handover_text="# H\n", |
| 24 | roadmap_rel="docs/ROADMAP.md", |
| 25 | roadmap_text="# R\n", |
| 26 | ) |
| 27 | policy = tmp_path / ".overseer" / "policy" |
| 28 | policy.mkdir(parents=True, exist_ok=True) |
| 29 | (policy / "tiers.yaml").write_text(f"token: {SECRET_MARKER}\n", encoding="utf-8") |
| 30 | |
| 31 | out = io.StringIO() |
| 32 | err = io.StringIO() |
| 33 | ctx = CliContext.create( |
| 34 | cwd=tmp_path, |
| 35 | kit=kit_root(), |
| 36 | output=OutputContext(json_mode=True), |
| 37 | runner=muse_mirror_status_runner(tmp_path), |
| 38 | ) |
| 39 | with redirect_stdout(out), redirect_stderr(err): |
| 40 | code = main( |
| 41 | [ |
| 42 | "init", |
| 43 | "--migrate", |
| 44 | "--force", |
| 45 | "--preserve-shared-assets", |
| 46 | "--from-config", |
| 47 | str(PILOT / "config-scooling.yaml"), |
| 48 | "--non-interactive", |
| 49 | ], |
| 50 | ctx=ctx, |
| 51 | ) |
| 52 | assert code == 0 |
| 53 | combined = out.getvalue() + err.getvalue() |
| 54 | assert SECRET_MARKER not in combined |
| 55 | payload = json.loads(out.getvalue()) |
| 56 | assert SECRET_MARKER not in json.dumps(payload) |
| 57 | assert ".overseer/policy/tiers.yaml" in payload.get("preserved", []) |
File History
1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
10 hours ago